CVE-2024-46668

An allocation of resources without limits or throttling vulnerability CWE-770 in FortiOS versions 7.4.0 through 7.4.4, versions 7.2.0 through 7.2.8, versions 7.0.0 through 7.0.15, and versions 6.4.0 through 6.4.15 may allow an unauthenticated remote user to consume all system memory via multiple...

CVE-2024-46668

An allocation of resources without limits or throttling vulnerability CWE-770 in FortiOS versions 7.4.0 through 7.4.4, versions 7.2.0 through 7.2.8, versions 7.0.0 through 7.0.15, and versions 6.4.0 through 6.4.15 may allow an unauthenticated remote user to consume all system memory via multiple...

CVE-2025-0394

The WordPress CRM, Email & Marketing Automation for WordPress | Award Winner — Groundhogg plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the ghbigfileupload function in all versions up to, and including, 3.7.3.5. This makes it possible for...

CVE-2025-0057

SAP NetWeaver AS JAVA User Admin Application is vulnerable to stored cross site scripting vulnerability. An attacker posing as an admin can upload a photo with malicious JS content. When a victim visits the vulnerable component, the attacker can read and modify information within the scope of...

WordPress plugin Groundhogg has a code vulnerability

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. A code issue vulnerability...

Fortinet FortiOS security vulnerabilities

Fortinet FortiOS is a set of security operating system dedicated to FortiGate network security platform from American Fita Fortinet. The system provides users with firewall, antivirus, IPSec/SSLVPN, Web content filtering and anti-spam and other security features. A resource management error...

Lingdang CRM security vulnerabilities

Lingdang CRM Lingdang CRM is a customer relationship management system from Lingdang, China. A security vulnerability exists in Lingdang CRM version 8.6.0.0 and prior versions, which stems from an incorrect operation of the parameter name that can lead to unrestricted uploads...

JeeWMS security vulnerabilities

JeeWMS is a JAVA-based warehouse management system from China Huayi JeeWMS. A security vulnerability exists in JeeWMS versions prior to v2025.01.01. An attacker can exploit this vulnerability to execute arbitrary code by uploading specially crafted files...

CVE-2024-50859

The GestioIP v3.5.7 web-based address management software is vulnerable to Reflected Cross-Site Scripting (XSS) via the ip_import_acl_csv request. The root cause is the failure to sanitize content when a user uploads an improperly formatted file ; the system reflects the file's content in the HTM...

PT-2025-1183 · Sap · Sap Netweaver As Java

Name of the Vulnerable Software and Affected Versions: SAP NetWeaver AS Java affected versions not specified Description: The issue is related to a stored cross-site scripting vulnerability. An attacker, posing as an administrator, can upload a photo with malicious JavaScript content. When a vict...

Code-Projects Online Car Rental System security vulnerabilities

Code-Projects Online Car Rental System is an open source car rental system from Code-Projects. A security vulnerability exists in Code-Projects Online Car Rental System version 1.0, which stems from a file upload feature that does not validate file extensions or MIME types, allowing an attacker t...

Venki Supravizio BPM security vulnerability

Venki Supravizio BPM is a process management solution from Venki Brazil. A security vulnerability exists in Venki Supravizio BPM version 18.0.1 and prior versions, which stems from a contained arbitrary file upload vulnerability. An authenticated attacker could upload malicious files, which could...

CVE-2024-42180

HCL MyXalytics is affected by a malicious file upload vulnerability. The application accepts invalid file uploads, including incorrect content types, double extensions, null bytes, and special characters, allowing attackers to upload and execute malicious files...

CVE-2024-42180

CVE-2024-42180 affects HCL DRYiCE MyXalytics (HCL MyXalytics). The vulnerability is a malicious file upload issue where the application accepts invalid uploads (wrong content types, double extensions, null bytes, and special characters), enabling an attacker to upload and potentially execute mali...

CVE-2024-42180 HCL MyXalytics is affected by a malicious file upload vulnerability

HCL MyXalytics is affected by a malicious file upload vulnerability. The application accepts invalid file uploads, including incorrect content types, double extensions, null bytes, and special characters, allowing attackers to upload and execute malicious files...

Starsea-Mall security vulnerabilities

starsea-mall is a springboot +thymeleaf based Xiaomi mall management system by StarSea99 individual developer. A security vulnerability exists in starsea-mall version 1.0, which originates from the parameter file file of the UploadController function in the file...

CVE-2024-47519

Backup uploads to ETM subject to man-in-the-middle interception...

CVE-2024-47519

Backup uploads to ETM subject to man-in-the-middle interception...

CVE-2024-47519 Backup uploads to ETM subject to man-in-the-middle interception

Backup uploads to ETM subject to man-in-the-middle interception...

CVE-2024-47519

CVE-2024-47519 is tied to Arista Edge Threat Management – Arista NG Firewall: backup uploads to ETM can be intercepted via a man-in-the-middle. The advisory details the affected product family and versions (NGFW/ETM, 17.1.1 and prior) and provides explicit remediation guidance. The root cause is ...